App privacy policy
Last updated .
This policy covers the Gatekeep Shopify app. This website is separate and collects nothing; see the site privacy policy. Use of the app is also governed by the app terms of service.
Who is responsible
For merchant account data, Gatekeep is the controller. For the customer data the app processes on a merchant's behalf during checkout, the merchant is the controller and Gatekeep is the processor, acting only on the merchant's instructions.
What the app reads
- Shop and account details
- Shop domain, plan and installation state, plus the access tokens Shopify issues when you install. Used to run the app and the subscription.
- Product and collection data
- Titles, tags, types and IDs, so you can map your products to the regulated categories Gatekeep covers.
- Checkout destination
- Blocking happens inside Shopify's checkout, in a Shopify Function that reads the shipping country, state, city and postal code. That check runs on Shopify's servers and sends nothing to Gatekeep.
- New orders
- When an order is placed, Gatekeep reads its ID and the shipping country, state, city and postal code to see whether it needs an age, permit, carrier or quantity check, and if so adds a tag to the order. Nothing else about the order or the customer is read, and none of it is stored.
What the app does not do
It does not sell or rent data, does not use merchant or customer data to train models, does not build advertising profiles, and does not share data with anyone except the subprocessors listed below. It does not read payment card numbers: Shopify handles payment, and the app never sees card data.
Retention
Gatekeep keeps no customer data. Shipping destinations are compared in memory and discarded; the app's logs record only the shop, the order ID and whether a tag was added. Shop configuration is kept while the app is installed and deleted when Shopify sends shop/redact, 48 hours after uninstall. One record outlives that: a one-way hash of the shop domain and the date its free trial started, so that each shop gets one trial. It contains no customer data and can't be turned back into the domain.
Data deletion and the Shopify GDPR webhooks
Gatekeep implements the three webhooks Shopify requires:
customers/data_request— acknowledged: the app holds no customer data to return.customers/redact— acknowledged: there is no customer data to delete.shop/redact— deletes the shop's data, sent by Shopify 48 hours after uninstall.
Subprocessors
Shopify, as the platform the app runs on, and Fly.io, which hosts the app and its database in the United States (Ashburn, Virginia). Cloudflare hosts this website but receives no app data.
Your rights
Depending on where you live, you may have the right to access, correct, delete or port your data, to object to or restrict processing, and to complain to a supervisory authority. Under the GDPR the lawful bases relied on are contract, for running the app you installed, and legitimate interests, for keeping it secure. California residents have the rights described in the CCPA as amended, including that Gatekeep does not sell or share personal information as those terms are defined there.
International transfers
Where data is transferred out of the UK or EEA, transfers rely on the UK IDTA or the EU standard contractual clauses as applicable. The hosting regions must be stated here before listing.
Security
Data is encrypted in transit (HTTPS only) and at rest, including backups. Only the operator can access production, using unique passwords and two-factor authentication, and API credentials are held as secrets rather than in source control. Security incidents affecting personal data are reported to affected merchants within 72 hours of being confirmed. No system is perfectly secure, and Gatekeep does not claim otherwise.
Contact
Privacy questions and rights requests: info@gatekeep.cloud.
Changes
Material changes will be notified in the app or by email to the shop's contact address before they take effect.